PlumeDocs

I built PlumeDocs for everyday PDF tasks: merge, split, compress and edit files in your browser. Its PDF tools process documents on your device, without uploading them to a server. They are free to use, with no account or watermark. Compression results depend on the file.

plumedocs.com security headers A 90/100

file-management · added 2026-09-17

Compare

Security headers: A, 90 out of 100

Number 12 of 95 in the ranking. Missing 2 of the 9 headers we check.

Meets the B minimum (70/100) in our RFP clause.

With these headers missing, plumedocs.com is more exposed to clickjacking.

Missing 2

Cross-Origin-Opener-Policy 0 of 5

Cuts the link between the product's window and windows opened by, or opening, other sites.

Without it: A page that opens the product keeps a handle on its window and can later redirect it to a look-alike sign-in or payment page (tab-nabbing) while the user thinks they are still on the real site. It is also part of the isolation browsers need to defend against Spectre-style attacks.
Cross-Origin-Resource-Policy 0 of 5

Tells browsers which sites may load this site's resources.

Without it: Other sites can pull the product's responses into their own pages, which makes side-channel leaks of what a signed-in user can see easier.

Sent 7

Content-Security-Policy 25 of 25

default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://www.googletagmanager.com https://connect.facebook.net https://googleads.g.doubleclick.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.google-analytics.com https://*.google-analytics.com https://www.facebook.com https://connect.facebook.net https://www.googleadservices.com https://*.doubleclick.net https://www.google.com; font-src 'self' data:; worker-src 'self' blob:; connect-src 'self' blob: https://www.googletagmanager.com https://www.google-analytics.com https://*.google-analytics.com https://*.analytics.google.com https://www.facebook.com https://connect.facebook.net https://www.googleadservices.com https://*.doubleclick.net https://www.google.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests
Strict-Transport-Security 20 of 20

max-age=63072000; includeSubDomains; preload
X-Content-Type-Options 10 of 10

nosniff
Frame protection 10 of 10

DENY
Referrer-Policy 10 of 10

strict-origin-when-cross-origin
Permissions-Policy 10 of 10

camera=(self), microphone=(), geolocation=(), payment=(), usb=()
No version disclosure 5 of 5

server: Vercel

Checked 2026-10-04 at https://www.plumedocs.com/. Re-checked every 7 days. The grade covers the headers this website sends, not the product’s overall security. How the grade works.